Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

LSASS.EXE infected


  • Please log in to reply

#1
Guig0

Guig0

    Member

  • Member
  • PipPip
  • 13 posts
Hi dudes,


I have a win2k adv. server that keeps rebooting by itself, due to an unexpected termination of the LSASS.exe.

I have seen tons of information about possible causes (viruses), and the respective fix methods, but none of the worked.


McAfee, Spybot, AdAware, CWS Shredder and TDS3 have failed in restoring my PC back to normal.
All of them got some bad files in the process, but the ystem keeps rebooting anyway.



is there anyone that knows a way to restore my server, and therefore my job, back to normal?


Thanks in advance! :tazz:

Edited by Guig0, 07 June 2005 - 03:21 PM.

  • 0

Advertisements


#2
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
is it doing this when booting, or after it's been running for a while?

Can you get into windows at all?
  • 0

#3
Guig0

Guig0

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
hi, thanks for your time dude.


yes, i can get in to windows normally.
the thing is that after a time, a system window pops up saying that the computer will be rebooted in xx seconds due to an unexpected termination of the LSASS.exe.


note that i cant place here the exact phrase coz my windows is in portuguese language, and i guess no one here would understand... so i did my best trasnlation.
  • 0

#4
Guig0

Guig0

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
update: my impression is that after many atempts using various AV softwares (listed in 1th post) i got rid of the viruses, but that LSASS.exe remains damaged.

is it possible?

and if it is, how can i restore it?
  • 0

#5
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
that's not how it works...the virus causes the error, so you must still be infected, or that's not it.

What AV programs did you run?

Do you have all service packs loaded? And patches after that?
  • 0

#6
Guig0

Guig0

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
used McAfee, Spybot, AdAware, CWS Shredder and TDS3

i do not have all SPs and Patches installed.. :tazz:



the only file that i did recognized as harmfull is frexxx.exe... do you know that file?
  • 0

#7
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
install them...

and no, that is not a windows file....
  • 0

#8
gerryf

gerryf

    Retired Staff

  • Retired Staff
  • 11,365 posts
Please go to the malware forum in my signature and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.
  • 0

#9
Guig0

Guig0

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
aye aye sir! :tazz:
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP